CmdID

CmdID / Commands

ps

List processes. toybox

On Linux, macOS 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD

List processes. Which processes to show (-gGuUpPt selections may be comma separated lists): Which FIELDs to show. (-o HELP for list, default = -o PID,TTY,TIME,CMD)

ps [-AadefLlnwZ] [-gG GROUP,] [-k FIELD,] [-o FIELD,] [-p PID,] [-t TTY,] [-uU USER,]
Show 22 options
-AAll
-aHas terminal not session leader
-dAll but session leaders
-eSynonym for -A
-gIn GROUPs
-GIn real GROUPs (before sgid)
-pPIDs (--pid)
-PParent PIDs (--ppid)
-sIn session IDs
-tAttached to selected TTYs
-TShow threads also
-uOwned by selected USERs
-UReal USERs (before suid)
-kSort FIELDs (-FIELD to reverse)
-MMeasure/pad future field widths
-nShow numeric USER and GROUP
-wWide output (don't truncate fields)
-fFull listing (-o USER:12=UID,PID,PPID,C,STIME,TTY,TIME,ARGS=CMD)
-lLong listing (-o F,S,UID,PID,PPID,C,PRI,NI,ADDR,SZ,WCHAN,TTY,TIME,CMD)
-oOutput FIELDs instead of defaults, each with optional :size and =title
-OAdd FIELDS to defaults
-ZInclude LABEL

Several platforms

from tldr-pages, CC BY 4.0

Information about running processes.

List all running processes

ps auxIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

List all running processes including the full command string

ps auxwwIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Search for a process that matches a string (the brackets will prevent grep from matching itself)

ps aux | grep [s]tringIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

List all processes of the current user in extra full format

ps --user $(id --user) -FIdentify

Trips 3 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad; lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

List all processes of the current user as a tree

ps --user $(id --user) fIdentify

Trips 3 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad; lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Get the parent PID of a process

ps --format ppid= --pid process_idIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Sort processes by memory consumption

ps [k sizeIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Display threads for a specific process

ps -L --pid process_idIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

macOS

from tldr-pages, CC BY 4.0

Information about running processes.

List all running processes

ps auxIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

List all running processes including the full command string

ps auxwwIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Search for a process that matches a string

ps aux | grep stringIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Get the parent PID of a process

ps -o ppid= -p process_idIdentify
-oOutput FIELDs instead of defaults, each with optional :size and =title toybox
-pPIDs (--pid) toybox

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Sort processes by memory usage

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Sort processes by CPU usage

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

What detects it

Sigma process creation rules that name ps
lowProcess DiscoveryÖmer Günal, oscd.community, CheraaghiMilad